vyos-1x.git, branch fix/T8955-http-api-verify-tls

http-api-client: T8955: enable TLS verification by default

2026-06-02T14:49:20+00:00

ApiClientConfig.verify_tls defaulted to False and ApiClient unconditionally silenced urllib3's InsecureRequestWarning, so TLS peer verification was off by default. The sole consumer, src/op_mode/config_sync.py, builds the client without passing verify_tls and therefore connected to a *remote* secondary VyOS node over HTTPS without verifying the certificate -- a MITM exposure on the channel that carries the API key and the full configuration. - ApiClientConfig.verify_tls now defaults to True and accepts Union[bool, str]; a string is forwarded to requests as a CA bundle path (verify=). - InsecureRequestWarning is suppressed only when verification is explicitly disabled (verify_tls is False), not when a CA path or True is set. - config_sync reads an optional verify_tls from the secondary runtime settings, defaulting to False to preserve current behaviour for self-signed secondaries. The insecurity is now explicit at the call site instead of hidden in the library default. A first-class CLI knob (set service config-sync secondary verify-tls / ca-certificate, with XML + migration) is the follow-up. 🤖 Generated by [robots](https://vyos.io)

Merge pull request #5236 from c-po/nat66

2026-06-02T13:42:26+00:00

nat: T8939: fix KeyError: 'group' exception

chore(mirror): remove force_workspace backport wrapper (R4 mothballed) (#5247)

2026-06-02T00:38:28+00:00

Mergify ignore_conflicts:true already creates the backport workspace PR + resolves toward theirs + applies backport-conflict for path-drift conflicts (verified by canary VyOS-Networks/ipaddrcheck#26/#27). force_workspace's 'No backport have been created' trigger never fires under that config. T8943 / IS-510.

ci(mirror-rollout-4): add force_workspace backport companion wrapper (#5246)

2026-06-01T23:19:34+00:00

Source-side wrapper (mirrored to the VyOS-Networks twin) for the public vyos/.github force_workspace reusable. Inert on this public source (owner guard); active on the mirror. force_workspace_enabled per-consumer (default false). 🤖 Generated by [robots](https://vyos.io)

Merge pull request #5245 from vyos/ci/lts-name-check

2026-06-01T09:40:25+00:00

T8943: ci: add lts-name-check advisory caller

2026-06-01T09:35:41+00:00

Adds the source-side LTS-name advisory caller (mirror-pipeline). Non-blocking; posts a generic advisory if a PR title/body references a release-train branch name. 🤖 Generated by [robots](https://vyos.io)

docs: AGENTS.md: reflect rollout 1c default-branch rename (#5244)

2026-06-01T00:03:04+00:00

T8943: migrate pr-mirror wrapper to canonical stub (#5243)

2026-05-31T23:00:43+00:00

Mirror Pipeline Rollout 2 Task 6. Uniform canonical wrapper: trigger branches [rolling, production], permissions: contents: read, drop redundant wrapper-level MIRROR_ENABLED guard (now central). 🤖 Generated by [robots](https://vyos.io)

ci: T8943: migrate branch-name refs current->rolling (rollout 1c) (#5241)

2026-05-30T15:38:38+00:00

Tracking: T8943

ci: T8943: sweep HIGH-producer pins to renamed branches (rollout 1c) (#5240)

2026-05-30T12:56:45+00:00

Rewrites uses: pins to the three HIGH-fanout producers (vyos/.github, vyos/vyos-cla-signatures, VyOS-Networks/vyos-reusable-workflows) from their old default branch to the new production compat branch staged in Task 1. No functional change; pin-ref rewrite only. Tracking: T8943